📘
DFIR
search
Ctrlk
  • Networking
    • Networkingchevron-right
  • Windows
    • Administrationchevron-right
    • Forensicschevron-right
    • Cheat Sheetchevron-right
    • Investigationchevron-right
    • Internalschevron-right
    • Active Directorychevron-right
    • MISCchevron-right
  • Linux
    • Forensicschevron-right
    • SSH
    • Linux WebShells
    • Directories of Interest
    • Internalschevron-right
  • Enterprise Architecture
    • CI/CD Piplinechevron-right
    • Citrixchevron-right
    • Web Applicationschevron-right
    • The Cloudchevron-right
      • AWSchevron-right
      • Azurechevron-right
        • Hunting
        • Admin
        • Securing Azurechevron-right
        • CheatSheet
        • Detections
        • Forensics
        • Attacking Azurechevron-right
          • Initial Accesschevron-right
          • Persistencechevron-right
            • Cloud VMs
            • Applications
            • SSPR/MFA
            • Automation Account
            • Identity Federation
            • Service Principals
            • Tokens
            • Cross Tenant Synchronization
            • Golden SAML
            • Conditional Access Policies
            • User Creation
          • Credential Theftchevron-right
          • Execution
          • Exfiltrationchevron-right
          • Test Page
        • Fundementalschevron-right
        • Loggingchevron-right
      • M365chevron-right
      • Cloud Labs
    • vSpherechevron-right
    • Containerschevron-right
    • Troubleshootingchevron-right
  • Mac
    • Forensicschevron-right
  • Attacker Information
    • Adversary Operationschevron-right
    • Actor Playbookschevron-right
    • Abused Domains
  • IR Playbook
    • Activity from Unmanaged Host
    • Recommendations
  • Reverse Engineering
    • Python - Pyinstaller
gitbookPowered by GitBook
block-quoteOn this pagechevron-down
  1. Enterprise Architecturechevron-right
  2. The Cloudchevron-right
  3. Azurechevron-right
  4. Attacking Azurechevron-right
  5. Persistence

Applications

LogoAppTotalapptotal.iochevron-right
LogoLocked Out, Dropboxed In: When BEC threats innovatewww.invictus-ir.comchevron-right
LogoHow to Backdoor Azure Applications and Abuse Service Principalswww.inversecos.comchevron-right

hashtag
What Is BLANK

hashtag
Attack

hashtag
Detect

hashtag
What logs are available?

hashtag
Mitigate

PreviousCloud VMschevron-leftNextSSPR/MFAchevron-right

Last updated 4 months ago

  • What Is BLANK
  • Attack
  • Detect
  • What logs are available?
  • Mitigate